fix(hooks): merge-guard mint-vs-read auth-token symmetry (#1031 + #1032)

[michael-wojcik]

Summary

Fixes the merge-guard mint-vs-read auth-token asymmetry — the single root cause behind #1031 (false-REJECT / usability) and #1032 (false-AUTHORIZE / security) — as one PR. The mint side (merge_guard_post) parsed AskUserQuestion prose while the read side (merge_guard_pre) validated the actual command; they drifted. The fix routes BOTH arms through one shared command-anchored extractor (so they can't drift again), makes the read side fail-closed, and fixes the selection-signal so a selected option carrying the command counts as approval.

What landed (10 commits)

• C1 refactor(hooks) — shared command-context extractor SSOT in merge_guard_common.py; both arms call it on a command string.
• C2 fix(hooks) — merge_guard_pre fails closed: positive op + target per op-class, no terminal allow (closes the untyped-token, malformed-context, and pr-axis fall-through holes).
• C3 fix(hooks) — merge_guard_post mints from the command literal + bimodal selection-signal + command-driven gate. SACROSANCT: the multiplicity gate counts distinct (op, target) pairs == 1, not raw command-regions (a region-count rule would refuse every template-conforming approval).
• C4 feat(hooks) + docs(commands) — command-in-approval convention template in peer-review.md + guard refusal-message guidance (never teaches the bare-command/reduce-the-question workaround).
• C5 test(hooks) — merge_guard_pre/post added to SEAM_DEPENDENT_HOOKS; AST-derived closure regenerated same-commit.
• Tests — bidirectional auth-symmetry suite (merge_guard_post mints token for the WRONG PR when approval text contains an unrelated #NNNN (false 'token does not match' rejections) #1031 R1-R7 authorize / Security: merge-guard authorization bypass — approval-prose shape authorizes an unapproved destructive op (fail-open on sparse token + None op_type) #1032 A1-A4 + A-DEFER block), WGE-1..5 write-gate-evasion, a non-mocked post→pre token-seam test (doc-anchored to the live template, no hardcoded copy), the COVERED_L2 partition, and the 145-residual retargeted to the fail-closed command-anchored contract. merge_guard: branch-delete auth token captures the delete-flag as the branch name, so an approved branch force-delete is permanently rejected #933 non-vacuity proven (per-mechanism source-only reverts + CLASS-II add-mutations).
• Version — 4.4.42 → 4.4.43 (PATCH).

Why

Empirically at HEAD: all 4 #1032 bypasses + A-DEFER were live and #1031 R1-R7 false-rejected. The asymmetry required fixing both arms together; the shared extractor makes future drift structurally impossible (the #720 dual-hook class). Confine-the-fix (#797) honored — zero token-lifecycle changes.

Testing

Full suite GREEN: 9684 passed / 11 skipped / 0 failed / 0 errors (rtk proxy + explicit 0-errors scan, pyenv 3.12.7). Non-vacuity: C2-revert → 4 RED, C3-revert → 17 RED, CLASS-II add-mutations → 3, seam → 3 — all RESTORE_CLEAN. Coverage ≥ 90% on changed mint/read paths.

Closure

Completes the acceptance criteria of #1031 and #1032; closure pending the post-install logged live-probe PASS (do not auto-close — runtime-hook gate per the established discipline).

Follow-ups (NOT in this PR)

• KD-6 force-push ref-form set — security-engineer ratification (the 2>&1 redirect case is an over-block, the safe merge_guard_post mints token for the WRONG PR when approval text contains an unrelated #NNNN (false 'token does not match' rejections) #1031 direction).
• multiSelect destructive approvals — resolve via LABEL-SET-MATCH (not a blind comma-split; real labels contain , ).
• merge-guard: is_dangerous_command false-positive — gh issue comment body quoting a dangerous command is rejected (substring-scan brittleness) #1037 (is_dangerous_command substring brittleness) — already filed.

Caveat

R7/#1034 is PROVISIONAL — asserted from the documented option-command structure (no verbatim captured payload exists); the load-bearing property (command-only-in-option + descriptive label mints) is exercised.